Hang caused by Linux Flash plugin

I've been experiencing occasional system lockups for over two weeks, and 
I've usually cvsup'd after them, hoping the problem was solved.  It 
hasn't gone away, but today I figured out a good way of reproducing the 
problem.  There's a flash applet that will lock up my machine if I 
fiddle with it for a few minutes.  It seems that I also need some niced 
load on the system at the same time (the hang had always interrupted a 
build of something).

It was always a hang that I couldn't get a crash dump or anything out 
of.  Now that I had a way of reproducing it, I tried a few things:
I removed the nVidia driver and switched to nv.  Still hung.
I enabled the debug options in the kernel and recompiled it.  Still 
hung, still no crash data.
Finally, I left my system at the text console and tried to produce the 
hang through a VNC session from another computer.  It hanged again, and 
without displaying any messages on the screen like I had hoped for.  No 
response to control-alt-delete, num lock light wouldn't toggle, etc.

I'm running -CURRENT from April 9, Mozilla 1.7b, and the Linux plugin 
wrapper.
The flash applet I can crash the system so easily with is at 
http://www.marumushi.com/apps/newsmap/

What else can I try doing?

dmesg output after booting:
Copyright (c) 1992-2004 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD 5.2-CURRENT #1: Sat Apr 10 20:03:27 PDT 2004
    brian_at_brian:/usr/obj/usr/src/sys/MYKERN
WARNING: WITNESS option enabled, expect reduced performance.
Preloaded elf kernel "/boot/kernel/kernel" at 0xc07ee000.
Preloaded elf module "/boot/kernel/snd_emu10k1.ko" at 0xc07ee244.
Preloaded elf module "/boot/kernel/snd_pcm.ko" at 0xc07ee2f4.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: AMD Athlon(tm) XP 1800+ (1533.40-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x662  Stepping = 2
  
Features=0x383fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE>
  AMD Features=0xc0480000<MP,AMIE,DSP,3DNow!>
real memory  = 1073676288 (1023 MB)
avail memory = 1045340160 (996 MB)
ACPI APIC Table: <AMIINT VIA_K7  >
ioapic0 <Version 0.3> irqs 0-23 on motherboard
Pentium Pro MTRR support enabled
random: <entropy source, Software, Yarrow>
acpi0: <AMIINT VIA_K7> on motherboard
acpi0: [GIANT-LOCKED]
pcibios: BIOS version 2.10
Found $PIR table, 11 entries at 0xc00f7f20
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
acpi_cpu0: <CPU> on acpi0
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pci0:0:0: setting power state D0
pci0:6:0: setting power state D0
pci0:10:0: setting power state D0
pci0:10:1: setting power state D0
pci0:16:0: setting power state D0
pci0:16:1: setting power state D0
pci0:16:3: setting power state D0
pci0:17:0: setting power state D0
pci0:17:1: setting power state D0
agp0: <VIA Generic host to PCI bridge> mem 0xe0000000-0xefffffff at 
device 0.0 on pci0
agp0: Bus reserved 0x10000000 bytes for rid 0x10 type 3 at 0xe0000000
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1:0:0: setting power state D0
pcib1: slot 0 INTA is routed to irq 16
pci1: <display, VGA> at device 0.0 (no driver attached)
dc0: <LC82C115 PNIC II 10/100BaseTX> port 0xe800-0xe8ff mem 
0xdfffff00-0xdfffffff irq 17 at device 6.0 on pci0
dc0: Bus reserved 0x100 bytes for rid 0x10 type 4 at 0xe800
miibus0: <MII bus> on dc0
dcphy0: <Intel 21143 NWAY media interface> on miibus0
dcphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
dc0: Ethernet address: 00:a0:cc:33:8e:1b
dc0: [GIANT-LOCKED]
pcm0: <Creative EMU10K1> port 0xe400-0xe41f irq 17 at device 10.0 on pci0
pcm0: Bus reserved 0x20 bytes for rid 0x10 type 4 at 0xe400
pcm0: <Cirrus Logic CS4297A AC97 Codec>
pcm0: [GIANT-LOCKED]
uhci0: <VIA 83C572 USB controller> port 0xdc00-0xdc1f irq 21 at device 
16.0 on pci0
uhci0: Bus reserved 0x20 bytes for rid 0x20 type 4 at 0xdc00
uhci0: [GIANT-LOCKED]
usb0: <VIA 83C572 USB controller> on uhci0
usb0: USB revision 1.0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub0: port error, restarting port 1
uhub0: port error, giving up port 1
ums0: Logitech USB-PS/2 Optical Mouse, rev 2.00/11.10, addr 2, iclass 3/1
ums0: 3 buttons and Z dir.
uhub0: port error, restarting port 2
uhub0: port error, giving up port 2
ulpt0: EPSON USB Printer, rev 1.10/1.00, addr 3, iclass 7/1
ulpt0: using bi-directional mode
uhci1: <VIA 83C572 USB controller> port 0xe000-0xe01f irq 21 at device 
16.1 on pci0
uhci1: Bus reserved 0x20 bytes for rid 0x20 type 4 at 0xe000
uhci1: [GIANT-LOCKED]
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0
uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhub1: port error, restarting port 1
uhub1: port error, giving up port 1
ugen0: Texas Instruments Incorporated TI-GRAPH LINK USB, rev 1.10/1.03, 
addr 2
uhub1: port error, restarting port 2
uhub1: port error, giving up port 2
pci0: <serial bus, USB> at device 16.3 (no driver attached)
pci0: Failed to set ACPI power state D3 on (null): AE_BAD_PARAMETER
pci0:16:3: setting power state D3
isab0: <PCI-ISA bridge> at device 17.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <VIA 8235 UDMA133 controller> port 0xfc00-0xfc0f at device 17.1 
on pci0
atapci0: Bus reserved 0x10 bytes for rid 0x20 type 4 at 0xfc00
ata0: at 0x1f0 irq 14 on atapci0
ata1: at 0x170 irq 15 on atapci0
acpi_button1: <Sleep Button> on acpi0
fdc0: I/O to control range incorrect
sio0 port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A
sio1 port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
ppc0 port 0x778-0x77b,0x378-0x37f irq 7 drq 3 on acpi0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/9 bytes threshold
ppbus0: <Parallel port bus> on ppc0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
fdc0: I/O to control range incorrect
cpu0 on motherboard
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
orm0: <Option ROM> at iomem 0xc0000-0xce7ff on isa0
pmtimer0 on isa0
fdc0: cannot reserve I/O port range (6 ports)
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 1533395582 Hz quality 800
Timecounters tick every 10.000 msec
acpi_cpu: throttling enabled, 16 steps (100% to 6.2%), currently 100.0%
ad0: 114473MB <WDC WD1200JB-00CRA0> [232581/16/63] at ata0-master UDMA100
ad1: 114473MB <WDC WD1200JB-00CRA1> [232581/16/63] at ata0-slave UDMA100
ad2: 78533MB <IC35L080AVVA07-0> [159560/16/63] at ata1-master UDMA100
acd0: CDRW <TDK DVDRW420N> at ata1-slave UDMA33
cd0 at ata1 bus 0 target 1 lun 0
cd0: <TDK DVDRW420N 1.39> Removable CD-ROM SCSI-0 device
cd0: 33.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from ufs:/dev/ad0s1a
lock order reversal
 1st 0xc6065e38 filedesc structure (filedesc structure) _at_ 
/usr/src/sys/kern/sys_generic.c:902
 2nd 0xc06f1c00 Giant (Giant) _at_ /usr/src/sys/fs/specfs/spec_vnops.c:387
Stack backtrace:
backtrace(c069e235,c06f1c00,c069a061,c069a061,c069544c) at backtrace+0x17
witness_checkorder(c06f1c00,9,c069544c,183,c0697b66) at 
witness_checkorder+0x6f6
_mtx_lock_flags(c06f1c00,0,c069544c,183,c069e835) at _mtx_lock_flags+0x9a
spec_poll(f0c63afc,f0c63b1c,c0579e3c,f0c63afc,c06e60c0) at spec_poll+0x147
spec_vnoperate(f0c63afc,c06e60c0,c6080c30,40,c1e6ae00) at 
spec_vnoperate+0x18
vn_poll(c6060b6c,40,c1e6ae00,c602c000,c1e6ae00) at vn_poll+0x3c
selscan(c602c000,f0c63b9c,f0c63b8c,4,4) at selscan+0x11b
kern_select(c602c000,4,bfbfe4d0,0,0) at kern_select+0x363
select(c602c000,f0c63d14,14,434,5) at select+0x66
syscall(2f,2f,2f,ffffffff,0) at syscall+0x242
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (93), eip = 0x282f1a4f, esp = 0xbfbfe47c, ebp = 0xbfbfe588 ---